Audit Logs

Audit Logs provide a comprehensive record of all state-changing operations performed within your ImageFactory environment. They are essential for security investigations, compliance auditing, and troubleshooting configuration changes.

Overview

ImageFactory automatically generates an audit log entry for every request that modifies the system state. This includes all mutation operations performed via the GraphQL API. Read-only operations (GraphQL queries) are generally not logged to maintain performance and reduce noise, with the exception of sensitive resource access if configured.

Audit Log Fields

Each audit log entry contains detailed metadata about the operation.

Field	Description
datetime	The exact timestamp when the operation occurred.
identity	The identifier of the subject (User email or API Key ID).
identityType	Whether the action was performed by a USER or an API_KEY.
operation	The specific action performed (e.g., template.create, account.delete).
responseStatus	The HTTP status code returned by the API (e.g., 200, 201, 403).
httpMethod	The HTTP verb used for the request.
url	The full API endpoint URL.
gqlMethod	The name of the GraphQL mutation (if applicable).
userAgent	The client application or browser used to make the request.
clientIp	The source IP address of the request (extracted from x-forwarded-for).

Extended Data

Depending on the operation type, audit logs may include additional context:

• Resource ID: For updates and deletions, the ID of the affected resource is recorded.
• Request Payload: For creations and updates, the data sent in the request body is captured. Note that sensitive values (like passwords or API secrets) are automatically redacted before being stored in the log.

Scoping and Retention

Audit logs are strictly scoped to the customer environment. Users can only view audit logs for the customers they have been granted access to.

By default, ImageFactory retains audit logs for a period of 90 days. If your organization requires longer retention for compliance reasons (such as SOC2 or ISO 27001), please contact support to discuss extended retention options.

Querying Audit Logs

To view audit logs, navigate to Audit Logs in the sidebar. The interface allows you to search, filter, and browse through all recorded operations for your customer environment.

For a detailed walkthrough, see the Variables & Audit Logs guide.

Via API

You can also search and filter audit logs through the GraphQL API. The API supports advanced pagination, sorting, and filtering to help you find specific events.

query GetAuditLogs($filter: AuditLogFilter!, $pagination: PaginationInput!) {
  auditLogs(filter: $filter, pagination: $pagination) {
    items {
      datetime
      identity
      operation
      responseStatus
      clientIp
    }
    totalCount
  }
}

Variables:

{
  "filter": {
    "operation": "template.*",
    "identity": "admin@company.com"
  },
  "pagination": {
    "page": 1,
    "limit": 20,
    "sortBy": "datetime",
    "sortOrder": "DESC"
  }
}

Use Cases

Security Investigation

If an unauthorized change is detected in a cloud account, you can use audit logs to determine if the change originated from ImageFactory. By filtering by clientIp or identity, you can trace the actions of a specific user or automated system.

Compliance Auditing

During a security audit, you may be required to provide evidence of who authorized a specific image build or who modified cloud credentials. Audit logs provide an immutable trail of these actions.

Change Tracking

When a build fails after a configuration update, audit logs allow you to see exactly what was changed in the template or component definition, making it easier to revert to a known good state.

Best Practices

• Monitor for Failures: Regularly review audit logs for 403 Forbidden responses, which may indicate misconfigured API keys or attempted unauthorized access.
• Integrate with SIEM: For advanced security monitoring, use the ImageFactory API to export audit logs to your Security Information and Event Management (SIEM) system.
• Use Descriptive API Key Names: When creating API keys for automation, use names that clearly identify the system (e.g., Jenkins-Production-Builder) to make audit logs more readable.